If I use the output of a cipher, for example a block cipher such as AES and encrypt it again with the same algorithm, I read that this introduces weaknesses into the overall security of the system.
Is this the case?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
Well, I don't know where you read that. However, depending on what they meant by that, that's either nonsense, or an appropriate cautionary tale.
What is known is that encrypting again cannot make the cipher weaker, as long as the keys you chose to encrypt a second time are independent of the keys you use the first time. The logic behind this is straight-forward; the attacker is assumed to know everything about the cipher except the keys. If he has some ciphertext that he wants to attack, there's nothing preventing him from picking his own "second time key", and then encrypting the ciphertext to form a doubly-encrypted ciphertext. If double-encrypting was inherently weaker, then he could attack that (and hence single-encryption would be equally weak).
On the other hand, if the two keys you use during the first and the second use are the same, this logic does not apply. And, in fact, there are ciphers where this encrypting twice with the same key is a Bad Idea. For example, some ciphers will, if you run the ciphertext through a second time with the same key, will generate a 'doubly-encrypted ciphertext' that is exactly the same as the plaintext; this is obviously weaker than the 'singly-encrypted ciphertext'
I assume you mean that you have encrypted a message $M_1$ (string of information) with AES and a key $K$, received an output $C_1$, and now want to insert the output $C_1$ back through AES (as a new $M_2$) using the same key $K$ to produce another output $C_2$. This is called super-encryption.
Since you deem AES to be secure to start with, it would be reasonable to assume it will not introduce a computational complexity security weakness. Repeating with the same key increases the computational complexity required to brute force the super-ciphertext, but not its security complexity (this is done by increasing the key). If you assume that all public block ciphers have inverse functions where given a ciphertext and a possible message one can get the Key (why brute force the key, when the message probabilities are lower, right?), and you must assume this, then your super-encryption process increases security, but only insofar as a super-inverse function has not been created. Using different keys solves this problem.
From an information theoretic perspective, read Shannon's "Communication Theory of Secrecy Systems" (PDF). If your message is shorter than the key you used, it has "perfect secrecy" to start with and there's no benefit to super-encryption. If your message is longer than the key but shorter than the unicity distance (The number of key characters / the redundancy in the message - use 84% for English), then in the case of a 256 bit key, 32 characters, you benefit from "ideal secrecy" for the first 38.09 characters only. Since 39 characters falls within 2 blocks, a brute force attack on the first two blocks only is sufficient to message-brute-force your ciphertext (even if super-encrypted). Increasing the key size, using 2 independent keys, for a key of 64 characters, moves the unicity distance to 76.19 characters, requiring 4 blocks to message-brute-force. A much greater computational complexity problem, but irrelevant in an information theoretic context. Note, this rule applies irrespective of the length of the ciphertext or super-cyphertext. Beyond the unicity distance, any cipher has no information theoretic security to speak of - it's "pseudo-security".
Contrary to public belief, attaining information theoretic security is not impossible, its actually quite easy, just stop thinking inside the box. There is no box, and it's your kind of question which helps us push the boundaries of what is possible.
I'd like to expand on some claims in previous answers.
encrypting a block twice with the same algorithm and key ... does not increase security
Rule of thumb is that it's true, however, you can imagine a crypto algorithm with not good enough properties, like bit diffusion. With such algo, applying encryption twice even with the same key may make it more secure (against non brute force attack).
But not talking about same keys, applying same algorithm several times definitely can improve the strength, actually, that's how venerable 3DES works - once original DES was found too weak, guys just took 3 times more bits, split them in 3 keys, and applied one after another (they did extra trick of applying "encryp-decrypt-encrypt").
Finally, it should be noted that a typical crypto algorithm consists of number of same (or highly similar) rounds. Each of them works while not with the same key, but with the set of keys directly derived from the original (i.e. inter-related). It's exactly repetition of these small sub-algos sufficient number of times what makes overall algo secure. For example, there're known attacks on reduced-rounds AES, but after some number of rounds, diffusion and permutation are that much, that dataflow analysis becomes infeasible (so far).
So, summing up, applying same algorithm several times can lead to continuum of consequences - from complete annihilation of encryption (XOR 2 times with the same key) to turning otherwise non-secure crypto-primitive into a really secure encryption.
No, encrypting a block twice with the same algorithm and key does not introduce any weakness. But on the other hand, it does not increase security either. The only difference is that a brute-force attack will take twice as long to perform. In the case of AES a brute-force attack already takes long enough to perform so there is no need to encrypt twice.
If you have several blocks and want to encrypt them with the same cipher and key, then the security depends on what mode you choose. In short, never use Electronic Code Book. If the clear-text is the same for two blocks, the cipher-text will also be identical in ECB mode. If you use CBC, make sure to always use a random IV. The IV must not be predictable. A good way is to encrypt a nonce and use the output as IV for CBC. The nonce value may not repeat as long as the same key is used. The recommended mode is ctr. It has several advantages over CBC (ctr can be computed in parallel, you can encrypt more blocks with ctr than CBC before having to change key, you never need a dummy padding block with ctr and if both sender and receiver keep count of the ctr variable, then you don't even have to include the ctr, in CBC you will have to send the IV in cleartext).
Edit. If you use counter mode, do not encrypt the same block twice with the same key and counter. The encryptions will cancel each other and produce the clear-text as cipher-text.